---
id: "CVE-2026-117537"
kind: "vulnerability"
aliases: ["CVE-2026-117537"]
title: "REDAXO: reflected XSS in metainfo API runs scripts in admin sessions"
severity: "medium"
cvss: 4.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["php", "redaxo", "runtime", "self-hosted"]
not_affected_if: ["version-5.21.0-or-later"]
published_at: "2026-10-27T11:17:34+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117537", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# REDAXO: reflected XSS in metainfo API runs scripts in admin sessions

REDAXO versions before 5.21.0 reflect the type parameter of the metainfo_default_fields_create API without escaping it through rex_view::message(). An attacker who lures a logged-in backend user to a crafted link can run scripts in that victim's backend session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the core package or `redaxo/src/core/boot.php` and confirm whether it is below `5.21.0`
- Confirm whether the backend is reachable by users who could be lured to a crafted link

## Fix

- Upgrade REDAXO to `5.21.0` or later
- Unknown whether a workaround exists before upgrading

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117537

## From the sources

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_